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Calendar Year 1977 


The Aerospace Safety Advisory Panel's report for Calendar Year 
1977 was given to Dr. Robert A. Frosch, Administrator of NASA, on 
October 12 , 1977 at a formal briefing which was open to the public. 

The material was updated to February 1978 in testimony by the Panel 
to the Senate Subcommittee on Science, Technology and Space, chaired 
by Senator Adlai E. Stevenson. Hence, the transcripts of these two 
meetings (Appendices A and B) represent the Panel's report on its 
1977 work and will form the basis of this written report. Thif pro- 
cedure differs from that used in past reports and documents a more 
timely Panel interaction with NASA and the Congress. We expect to 
continue in 1978 with two public meetings to report to our constitu- 
ency and then submit a record document in early 1979. 

Recent Panel reports have been divided into two parts, the 
second volume of which was the data received by the Panel in its 
various meetings and briefings. In that this material duplicates 
that freely available in the Panel staff files or in NASA and its 
contractors' files we have decided that it will be more effective to 
list only the various Panel and fact-finding meetings that have oc- 
curred during the year, with date and place of the meetings, and a 
summary of the material covered (Appendix C) . This procedure will 
allow retrieval of the data upon request and at the same time produce 
a more readable report. 

During the course of the year the Panel has been almost exclu- 
sively concerned with the Space Shuttle. However, at the end of 
1977 we prepared to investigate some of NASA's non-space activities 
that have significant safety implications. Our 1978 report is expected 
to reflect this activity. We will continue our policy of bi-monthly 
formal meetings with fact-finding scheduled for the intervening months 
and are turning a portion of our attention to the area of Shuttle pay- 
loads. 


During 1977 there were a number of events that caused delays 
and changes in the Shuttle program, but the Panel feels the signifi- 
cance of the successful approach and landing tests should not be 
underestimated as a positive indication of the basic state of the 
aerodynamic qualities of the aircraft and the modeling and analytical 
work that went into the Orbiter design and particularly its control 
system. This test program exercised the Orbiter in its unpowered 
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final landing mode. The tests uncovered minor problems which could be 
fixed without change to the basic design concepts and, more importantly, 
they provided a demonstration of the adequacy of the Orbiter design and 
in the quality of the modeling and analysis on which the design was 
based. While this does not directly verify the eventual orbitii flight 
performance, it lends credence to the analysis methods by which new 
problems can be approached with a degree of confidence not before justi- 
fied. 


The various concerns expressed by the Panel members at its public 
meeting are distributed through the transcripts and are summarized here 
for clarity. We should preface this by 3aying that the Panel is well 
satisfied by the NASA programmatic responses to its comments. During 
the course of the investigations we confer with the concerned people 
and develop an understanding of the technical depth leading to designs 
and test decisions. The resultant clarification in many cases relieves 
a Panel concern. The Panel's critique is believed to be objective and 
safety-oriented and is not constrained or influenced by the Shuttle 
program budgets and schedule. For this reason we do not expect that the 
program will implement all specific suggestions but will seek solutions 
that can be fit more easily into the program. The Panel's goal is to 
bring different viewpoints to the attention of the program directors to 
insure that all aspects of any problem are considered and to assure that 
any accepted risk is fully evaluated before it is assumed. The Panel is 
an advisory body, not a decision-making one. 

During the year we were asked several times for our opinion on 
the readiness of the Orbiter for various phases of the ALT program. 

On all occasions we were of the opinion that the Orbiter was ready for 
flight. 


In the Panel's review of the various aspects of the Shuttle pro- 
gram one caution is continually sounded: the necessary testing to 

establish confidence must not be slighted because of budget or schedule 
pressures. The budget and schedule are tight and pressure to reduce 
the number of planned tasks is inevitable ?nd must be resisted. In 
light of this it is necessary to identify those test programs that are 
mandatory and make provision to see that they get done. Areas where 
this is particularly important are those which confirm Avionics software, 
main engine reliability, flight control systems (particularly the non- 
redundant elements) and the ti-yrmal protection system. 

The Panel feels that as the Shuttle matures it will become a 
transport aircraft and that the design philosophies of that industry 
regarding redundancy of flight controls and concepts to achieve "fail 
operational" systems should be incorporated wherever possible. We 
acknowledge the problems of making changes at this time, but an indepen- 
dent review of the control system vulnerability to specific failures 
may well be in order. 

A method of identifying and quantifying aggregate risk should be 
developed if at all practicable. It is not easy to get a meaningful 
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numerical answer to this problem* The Panel has been working with 
the reliability and quality assurance groups and some headway is 
being made. The work should continue and should include specific 
detailed engineering input regarding potential subsystem failure 
modes. 


The Avionics system used in the landing tests was adequate , 
but orbital flight control is more complex and will utilize a differ- 
ent computer. It would seem prudent to obtain an independent assess- 
ment of the software, including off-nominal situations that could 
affect all computers. 

The auxiliary power units have had a history of troubles that 
make their reliability questionable. These can, of course, be de- 
velopmental problems, but an overall review of these units, including 
hot restart and full assessment of environmental impact on reliability 
may well be in order. 

The thermal protection system concept seems to be soundly 
based, but manufacturing and application problems need continued 
review and test confirmation if we are to get a better appreciation 
of the effects of steps, gaps, and potential handling damage on the 
tolerance to heat input. These factors greatly influence tile yield 
and the ease or difficulty of application. It is also important to 
review the planned trajectory of the first flight in order to minimize 
the combined heating rate and load on the thermal protection system. 

The development of the main engine— a difficult task — has been 
slowed down by unexpected problems. The Panel does not believe that 
these are insoluble, but adequate time must be allowed in the schedule 
for real solutions — not questionable fixes--to be developed. Testing 
must then be done on individual engines before the main propulsion 
tests are begun. This could affect the schedule for orbital flight 
tests. 


The severe technical problems that have been encountered in the 
development of the Shuttle hardware have properly occupied most of the 
time of the program reviewers and managers. It is now appropriate to 
evaluate the training activities of the many people involved in the 
preparation, launch, and maintenance of the Shuttle. Reliability of 
these activities requires adequate checklists, procedures, and train- 
ing programs if they are to fully support Shuttle operations. 

The Panel is of the opinion that the Shuttle program is in 
excellent shape when viewed in the context of the overall task, schedule 
and budget. 

The Space Shuttle task assumed by NASA was to proceed from an 
experience of individual scientific experiments to the design, con- 
struction and demonstration of a routine transportation system. The 
conventional approach to this problem would be in a series of steps: 


first, to establish performance; second, to establish life; and third, 
to establish routine operation. NASA chose to approach this multi- 
year, multi-billion-dollar project in one continuous success-oriented 
program. The Panel's reviews lead it to believe that no insurmountable 
technical problems are apparent at this time and that in the context of 
the whole the schedule delays and budget overruns have not been signifi- 
cant, We are now entering the crucial period of total system confirma- 
tion, and evaluators and development teams must be alert to potential 
unforeseen problems and vigorous in their complete solution. Now, 
wore than at any time In the program, the momentum, the schedules and 
the visibility of any program problem will provide an environment 
within which less than complete solutions will be tempting. This must 
be avoided at all costs. 
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INTRODUCTION 


The Aerospace Safety Advisory Panel was established by statute 
some ten years ago to provide an independent, knowledgeable identifi- 
cation anu assessment of undue risks attendant to NASA's operations. 
Priority was to be given to manned flight, and the Panel, while it is 
to comment on the adequacy of proposed safety standards, does not have 
a responsibility to solve problems, set standards or alleviate risks. 

Briefly stated, the Panel's role is to make UBe of its observa- 
tions and experience to 

1. advise where we see risks; 

2. in areas of high risk, investigate adequacy 
of solutions? 

3. in areas of excessive risk, recommend alter- 
nate solutions? 

4. review the adequacy of the Management System 
to perceive and cope with risks? and 

5. identify areas that need support in the 
solution of risk problems. 

In any consideration of the role of the Panel it must be borne 
in mind that the composition of the Panel will, in fact, have a great 
effect on what is asked of it and what it can accomplish. The Panel 
consists of a group of senior persons, each of whom is experienced in 
the management of technically oriented or complex projects. The mem- 
bers are appointed by the Administrator of NASA and the Panel is con- 
gressionally chartered. 

The value to the Administrator of the Panel's activities lies in 
the objective overview of NASA and its contractors' management system 
and their results, by a group without operational responsibility but 
with program continuity. 

The Panel has developed the procedure of reviewing programs, 
selected hardware, and management procedures of NASA and its contrac- 
tors for evidence that the proper management emphasis is placed on 
safety and the achievement of mission goals without undue risk. The 
Panel holds two-day formal meetings approximately bi-monthly? its 
members attend formal reviews and also talk informally with NASA and 
contractor managers and operating personnel. This mode of operation 
affords individual Panel members the opportunity to review specific 
program plans and selected hardware in the field of their special 
interests or expertise. Prom these investigations the Panel identifies 
what, in its opinion, are reducible risks and assesses the impact on 
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NASA's operations of making changes or accepting the risks. The Panel's 
work is presented to NASA management in the course of informal as well 
as formal discussions, and is recorded in an annual report for both 
Congress and NASA management summarizing the Panel's conclusions and 
data base. 

We would propose to continue the fact-finding in areas that 
need attention, and then to draw conclusions from the facts and our ex- 
perience that will bo useful to NASA in the management of its work. 

W@ believe there are two past examples that are pertinents we were 
instrumental in getting NASA to name a chief engineer; and also in es- 
tablishing a technical assessment group. The Panel also fulfills its 
responsibility by expressing its opinion as to the risk involved in 
specific NASA operations that it has investigated. This has proven to 
be helpful in the past and we wili continue with such assessments sub- 
jects, as before, to the limitations of our time and expertise. 

With the advent of the Shuttle program with its goal of a reus- 
able transportation system, the Panel found it necessary and desirable 
to divide up the fact-finding workload by assigning certain Panel mem- 
bers to various aspects of the Shuttle, taking into account the experi- 
ence and interests of the members. They then report to the Panel in 
full session and a consensus is developed. We propose to continue this 
procedure. Now that ALT is almost complete, we plan to reorganize our 
assignments to focus on OFT and begin in aeronautics as follows: 

FACT-FINDING ASSIGNMENTS 


Member Shuttle Fact-Finding Responsibility 


c. 

A, 

Syvertson 

Mission Operations and TPS 

w. 

M, 

Hawkins 

Orbiter 

s. 

C. 

Himmel 

Propulsion 

H. 

E. 

Grier 

Avionics 

F. 

C. 

Di Luzio 

Hazard Assessment 

C. 

D. 

Harrington 

Control of Human Error 

H. 

K. 

Nason 

Payload Hazard Assessment 

w. 

D. 

Johnson* 

Launch Preparation and Logistics 

a. 

L. 

Kuranz 

Aeronautics 


‘Resigned; replaced by Lt. Gen. Leighton !,• Davis, USAF, Ret. 
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Today we will comment on the upcoming tailcone-off flights as 
we have on the previous ALT flights. An explanatory comment is ap- 
propriate, The Panel has traditionally been asked its opinion about 
the state of readiness of operations as a whole, but we now sense 
that as a result of our interest in some of the details we may appear 
to be certifying operational events. This is not our role and can mis- 
lead one as to the extent of our certification, no matter how quali- 
fied it may be. Our Panel cannot be expected to investigate in detail 
all tha aspects of an operation which are required for a complete 
certification. This certification is the task of the programmatic 
organisation which we can supplement by knowledgeable, independent 
assessment, but we cannot supplant the responsibility of the program 
organization. 

It is worth repeating that the ASAP is a group of senior, experi- 
enced people who should dig into details only enough to interpret from 
their experience the shortcomings, if any, of the Management System 
and to make recommendations for its betterment. We should not attempt 
to do technical design no matter how appealing the job is to us— 
that's not our job. Neither should we certify an operation unless we 
have examined it in depth. 

We need a definition of the Management System we are talking 
about. We would say that it is the NASA organization that identifies 
tasks, formulates specifications, assigns responsibilities and monitors 
performance so as to achieve effective and economical solutions to the 
problems at hand, ASAP has a legitimate concern with this because in 
the "chips are down" operation which NASA is responsible for, safety 
in its broadest sense is a result of the proper solution of all the 
problems. It is also important to spend no more than necessary on a 
given phase of the problem, to assure that funds are available for other 
areas that need to be worked on. We will talk about the test program 
in this context. 

In all the Panel's work there is a common thread and that is 
risk — its identification and assessment. A problem that greatly con- 
cerns us, as well as many other people, is what is the aggregate risk? 
What is the composite result of all the individual risks that one 
identifies, quantifies and accepts? In any complex undertaking where 
design is divided into subsystems and done by different groups, it is 
difficult to coordinate the effect of all the engineering tradeoffs 
on the total system. In the case of the Shuttle, this process is 
further complicated by the fact that not only technology, but money 
and schedule pressures also drive the tradeoffs. In fact, the same 
problems exist in individual subsystems where design efforts and ex- 
ternal influences have been traded off over a long period of time. 

The shuttle is such a complex system that judgment alone may be inade- 
quate as an assessment tool. 

It is suggested that there should be a formal effort within the 
program to quantify the aggregate risk to the project of the total system 
concept and the changes that have occurred in the design and test pro- 
gram. 



Th«r« a ra many methods of identifying a risk, but it can only 
be quantified aa the result of a teat program and hence the importance 
of the teat programs that NASA so stresses, a program as large as 
shuttle the amount of testing can be so graat that it must be reviewed 
to make sure of its pertinency and necessity in order that all risks 
inherent in the mission environment are accounted for within a test 
program that can be accomplished within the time and funds available. 

in an evaluation of the adequacy of the test program for risk 
assessment the tendency is to propose an outside entity to take a 
"fresh" look, ibis is difficult for two reasons. First, the people 
making such an assessment must have been involved virtually from w day 
one" so that they know the entire history and modus operand! and, 
second, this should not be an ad hoc effort, but a continuing part of 
the Management System. We bellevQ the capability and funds to do this 
are within NASA, but it should be a discrete responsibility. It can- 
not be done by the engineering organization as a part-time effort. 

The Technical Assessment Group at JSC would seem to be a good model for 
the aggregate risk assessment task and perhaps could be involved in the 
task via a restructuring and the addition of some personnel. In order 
to place the aggregate risk assessment in the proper perspective and 
yet involve it adequately, it should probably be a, programmatic staff 
function, but in any awt should not have an engineering design function 
of any type. 

This year it seems appropriate to involve the Panel in NASA's 
aeronautic as opposed to manned space activities. The charter estab- 
lishing tha Panel directs priority to manned space flight, but makes 
provision for review of the other NASA programs. The organization and 
character of the manned space flight activities are different from the 
other programs, and the first step the Panel should take is an identi- 
fication of its appropriate relationship to these, new to it, activi- 
ties. To this end we have assigned a prime responsibility to one of 
our members to the role of the Panel in this area. In doing this we 
intend to solicit program input and to submit our plans for concurrence 
before proceeding. 

The continued and broad overview of the Management system does 
not rule out the Panel's applying its expertise on an ad hoc basis to a 
specific problem for the Administrator. A good example is the Panel's 
consideration of the threaded fastener problem where a public charge 
was made that NASA was procuring inadequate fasteners for its programs. 
The Panel's investigation and opinion helped NASA refute that charge. 

In summary, the Aerospace Safety Advisory Panel is a senior, 
experienced group with continuity, whose task is to review the pro- 
grams of NASA and identify for the Administrator undue risks that may 
have escaped the notice of the program managers as a result of their 
close involvement with daily problems. It is also to assess the po- 
tential or aggregate risk as a result of the acceptance of many indi- 
vidual risks, each one of which was validly accepted. 
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MISSION OPERATIONS 


The outstanding success of the ALT programs is of itself a 
batter report on the mission operations than the Safety Panel could 
present, As the program has progressed there have been some 
schedule problems, some equipment problems and some procedural prob- 
lems, In fcoto, however, these have been minimal alongside the fact 
that the technical objectives of tho flight series have been met and 
the specific answers have, in almost all cases, been positive from the 
program point of view. For us to dwell on these points would be repet- 
itive and unnecessary. There are two points, however, that the Panel 
feels bear emphasis. 

First, the Panel is impressed by the indications from ALT that 
tho modeling and analytical procedures used in the Orbiter design have 
been relatively closely validated. This gives a substantial degree of 
confidence in the theoretical and model work involved in the upcoming 
OFT activities, while the problems in the orbital and entry phases are 
different than in the subsonic regime. It is a milestone to document 
a good general concurrence between theory and practice in the early 
phases of the flight test programs leading to orbital flight. 

The second point that we should like to stress is the dedication 
and competence of the entire flight test organization under Deke 
Slayton. These people represent a somewhat different cuLture than the 
more theoretical and scientific design people in the program, and the 
burden of bridging the gap is on them. They must understand and make 
work the product of the program. They did this magnificently, and 
successfully demonstrated what, up to the present, has turned out to 
be a superior product. 



ORBITER READINESS fOR ORBITAL PLIGHT TESTS 


Introduction 


Before discussing the current status of the Orbiter and its 
system, it should be emphasized that the operation of the ASAP and 
its individual members would not be possible without the open doors 
of the NASA Centers and the contractors to the requests, questions 
and visits of the Panel. I, for one, want to express my gratitude 
for this universal attitude* 

NASA, since the start of the Shuttle program, has been con- 
strained by budgetary pressures and originally estimated schedules 
that define a substantially different program environment than NASA 
Las been exposed to before* This has constrained changes when the 
original concepts were found to be less than optimum, and it has 
caused the program to be planned as a completely successful venture. 
The Inevitable difficulties have caused test programs and decision* 
to be postponed with the result that many tasks are left to be done 
close to first orbital flight. 

A second factor that has impacted the program is that the 
NASA Centers and the chosen contractors have accumulated their 
experience in space or military aircraft programs and there is little 
awareness of the growth and sophistication of the technologies im- 
plied by aircraft designed to "fail -operationally." These tech- 
nologies are most apparent in agencies, government and commercial, 
involved in transport aircraft for the military and the airlines. 

In spite of these problems, the program has made remarkable 
advances as demonstrated by the latest tailcone-off ALT experiment. 

Orbiter Status, General 


The ALT flights, now including the first tailcone-off experi- 
ment, have demonstrated the aerodynamic, the control system, the 
computer, and the operational concept of horizontal landing in an 
impressive way* Based on this success, the ASAP suggests that the 
remaining fcailcone-off flights should include an experiment, even 
if very short, in which the blind landing system flies the aircraft 
on approach. 

Still to go, however, is a thorough evaluation of the boost- 
ers, the external tank, the launch system, and the abort planning. 
The ASAP will spend the remainder of this year and next in expanding 
its attention to these system elements and operations plans. 

Plight Control Systems 

Very early in tho deliberations of the ASAP we questioned the 
concept of the flight control system and its vulnerability to single 
point failures. The state of the art in transport aircraft, both 
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military and commercial, has progressed substantially since the 
Shuttle control system was conceived, and it would be profitable 
for the future operations of the Shuttle to incorporate as many 
of the new concepts of how to design fail-safe and fail-operational 
systems into the Shuttle. 

An example of one such Shuttle control system is the rudder 
speed brake actuation subsystem. There are several critical points; 
for instance, the gear boxes which if they fail completely will jam 
the entire system, in spite of the fact that the system is fed by 
three completely independent hydraulic power sources. Since there 
are two of these gear boxes in series and since the gear loadings 
are higher than is standard practice on helicopters, it is essential 
that test programs for certification be strenuous and thorough. 

Similar single point failure potentially exists in the two drive 
shafts and eight actuators, any one of which, if completely jammed, 
eliminates that side of the rudder speed brake system. Here, too, 
test programs are essential to confirm that these elements are 
sufficiently reliable and that they do not constitute a hazard to 
the Shuttle flight's success, 

A somewhat different single point failure problem appeared 
in the elevon servoactuator system. Three hydraulic power sources 
are again available, but the system comes together in a single 
switching valve system, power spool and single ram actuator. NASA 
responded to initial criticisms of this system and has redesigned 
the actuator eliminating many single point failure elements. There 
are now only 11 such elements per actuator a.id these have been de- 
signed in such a way that a leak is prevented even though a seal 
fails by means of a backup close fitting metallic seal with a con- 
trolled leak rate sufficiently low that the hydraulic capacity is 
not exceeded for any one mission. There are four such actuators on 
the Orbiter and they, too, must be subjected to an extremely critical 
testing program to confirm their adequacy. In a review of all the 
systems on the Orbiter there are a number that are shown to have 
similar characteristics. The body flap is similar to the speed brake 
and the main engine vector control pistons are similar to the Portress 
piston. There is a rather different potential problem concerning the 
main engine fuel control which relies on hydraulic power for opera- 
tion. In this case the hydraulic control is a single string and 
depends upon an APU for power. There is no backup hydraulic power. 

Thus, if the hydraulic power fails, that fuel control is locked in 
whatever position it was operating at. It is not known how long the 
control will stay in the locked position. If it drifts or is in a 
position which would cause the engine to reach any safety temperature 
or pressure limit, the engine will shut down, causing the Orbiter to 
enter some kind of abort mode. It is suggested that testing of the 
main engine should include a simulated failure of this kind. If the 
likelihood of the engine continuing to run is high, this may not be 
critical. However, the Panel could find no confirmation of this likeli- 
hood and thereby suggests that accumulators or backup hydraulic systems 
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be considered to prevent this failure. The APU is the source of all 
hydraulic power and has been a continuing problem during development. 
Although there are three APUs driving the three separate hydraulic 
systems, the likelihood of one or wore APU failure in the early 
Orbiter's flights would seem to be perceptible. It is suggested 
that the program review instal?.ation of backup accumulators or a 
fourth system for early flights. In any case, those early flights 
should be loaded such that the center of gravity is in a position 
where reentry and landing might be possible with only one hydraulic 
system operating. Similarly, flight modes should be selected that 
provide the highest chance of return with jammed dive brakes or body 
flaps . 


Testing Program 

As a result of early pressures on the budget and on the concepts 
of the various system elements, many of which have changed, the testing 
programs have become compressed and some are scheduled quite close to 
the first orbital flight. 

Prom the schedule for delivery and test of the Fortress pistons 
for the elevon actuators it is noted that the qual testing of two units 
is completed just 45 days prior to the scheduled first orbital flight. 

The Panel urges that subsequent rescheduling not reduce any of this 

qual testing and that the orbital flight be delayed, if necessary, 
until the units are qualified. A series of tests is then planned, en- 
titled Fortress-Plus Testing. This is not completed until the Spring 
of 1980, substantially beyond the first orbital flight. Since this is 

the kind of testing designed to confirm how many reuses can be made of 

the system rather than to confirm that the system is adequate for its 
function, it is normal that the test span would come after the first 
orbital flight. The Panel is not concerned by this overlap. 

A similar problem that has not yet been fully defined exists 
with the Orbiter's reaction control subsystem. Due to the fact that 
the configuration of this system was changed late in the design pro- 
cess, the implications for testing the elements have not been fully 
evaluated. 

We note that there are a number of configurations of reaction 
control rockets. Although there are only two types of combustion 
chamber and throat, the skirt configurations are numerous and differ- 
ent. Since these rocket nozzles are exposed to external heat loads, 
the reentry end must be designed so that the radiant heat output within 
the installation fairing is controlled. The implication is strong that 
the test program will be complex. This will be one of the Panel's 
evaluation subjects through the end of 1977 and all of 1978. 

Summary Assessment 


It would appear that the multiple system concepts of the Shuttle 
do not represent the known state of the art in design for "failing- 
operationally. " The NASA laboratories have responded by making 
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substantial changes and augmenting the test program to validate those 
elements of the system which could be construed as single point failures. 
It is suggested by the Panel that many of these systems should be re- 
viewed in the event that added shuttles are purchased. The Aerospace 
Safety Advisory Panel will review in detail the redundancy concepts 
in the cabin and environmental system, the reaction control system (as 
previously noted) , the APU (its water boiler, lube system, control 
valves and operation in the main engine environment) , and also the 
boosu and main engine vector controls. The Panel will reconsider the 
abort concepts to determine if additional changes to the Shuttle could 
be made in order to avoid some of the most hazardous. 

The Use of Safety Panel and Other Outside Reviewers 

It would appear from the ASAP experience that many of our cur- 
rent concerns might have been avoided had the Panel been involved in 
the early concept of the system. This suggests that similar evaluation 
groups should be brought in whenever possible while the system concepts 
are being formed. It is worth noting that the McDonnell-Douglas review 
of the current flight control system is to be completed only nine 
months before the first orbital flight. It is obvious that any output 
from such a *eview will be too late to affect the configuration of the 
Shuttle before first launch unless the change implied is quite simple. 

In view of the complexity of this system, the McDonnell-Douglas review 
should continue, but if major problems are uncovered the first flight 
schedule is bound to be delayed. 

It is the Panel's opinion that NASA has responded completely to 
all of the Panel's suggestions and has outlined test programs which, 
when completed, should confirm that the present Orbiter will fulfill 
its mission safely. 



SPACE SHUTTLE MAIN ENGINE 


This past year has seen both significant progress and some 
serious technical problems in the Main Engine program. Problems 
were, perhaps, to have been expected as the engine represents a 
venture into new areas of technology. As a result of the prob- 
lems the program is behind schedule, and work-around plans to 
support key milestones have had to be devised. 

Problems 

As has been the case for the past year, the turbomachinerv is 
the principal focus of the technical troubles of the engine develop- 
ment program. A series of major problems, two involving hardware 
failure and fire, have kept the program behind schedule. 

At the beginning of the year the High Pressure Fuel Turbo- 
pump (HPFTP) exhibited subsynchronous whirl and turbine bearing 
problems that precluded operating at RPL. After Intensive efforts, 
stiffening of the HPFTP shaft and modification to the turbine bearing 
coolant flow brought the problems under control. These changes per- 
mitted the achievement of engine operation at RPL early this spring. 

Shortly thereafter a High Pressure Oxygen Turbopump failed 
during an engine test at NSTL. The failure was accompanied by a 
fire and, in addition to destruction of the pump, major damage was 
done to the engine. The test stand suffered only minor damage. It 
took quite a while to determine the cause of the failure. The origin 
was found to be in the seal assembly that serves to isolate the tur- 
bine from the pump. To permit the resumption of engine testing, an 
inte im fix was devised. The lift-off face seal that had served as 
the primary LOX seal was replaced with a three-step labyrinth seal 
and the helium purge flow rate in the intermediate seal was increased 
substantially. Ultimately the entire seal assembly must be revised. 
The character of the revision is well defined and development testing 
at the seal level is in process. 

With the interim seal modification, many successful, long- 
duration runs were achieved from late July through August. About 
4,000 seconds of running were accumulated in this relatively short 
interval. The average thrust levels for these runs increased as 
the test program proceeded. During this period a 301-second dura- 
tion run at RPL was achieved. Then, on September 8, another failure 
occurred. This also involved a LOX fire and resulted in the loss of 
most of a HPOTP, a LPOTP and the interconnecting duct. Again, test 
stand damage was minor. 

The investigation is still going on. It appears that the 
failure originated within the HPOTP. To date the HPOTP seals have 
been exonerated. There are indications that there was a bearing 
overload. Whether this is cause or effect is yet to be determined. 
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Of concern is that the failure may have resulted from a subtle 
marginality in detail mechanical design. Two other pumps of the same 
configuration have been run for considerable time without failure, 
albeit one of them showed some evidence of bearing distress. Another 
possibility is that some phenomenon associated with long running at 
high power levels may be manifesting itself. In the highly mechani- 
cally-interaetive system of a high speed, high pressure turbopump it 
would not be surprising for load distribution to change significantly 
as power level changes. Such a shift could, for instance, easily 
change an acceptable bearing load to an unacceptable one. Possibilities 
such as this one are being examined by the investigating teams that have 
been established. Testing has recently been resumed with added instru- 
mentation. Hopefully, the data will help in finding the culprit. 

This most recent problem has impacted the Main Propulsion Test 
(MPT) program that htv been scheduled for December. It would obviously 
be imprudent to risk a a, .age to a set of three engines in the MPTA prior 
to establishing and implementing corrective action for this last failure. 

Progress 

All is not bleak in the program, however. On the positive side 
of the ledger, the engine has been operated at rated power level (RPL) 
a number of times including the 301-seeond duration run noted earlier. 

The 75:1 area ratio nozzle has been run successfully. The combustion 
systems have proven to be stable and, with trimming type modifications 
to injector flow patters, should provide the desired life characteris- 
tics. Much of the auxiliary equipment has completed design verifica- 
tion testing satisfactorily and the remaining tests are on schedule. 

The controller has performed very well in the field. It has proven to 
be a great asset to the program by permitting changes in sequencing 
and valve rates to be made via software rather than hardware. This 
provides for rapid development of start sequences and desired system 
dynamics — previously a slow process. 

The thermodynamic performance of the turbomachinery has been 
established experimentally. The design modifications required to cor- 
rect performance deficiencies have been defined and sufficient experi- 
mental verification has been obtained to warrant confidence that 
desired thrust and efficiency can be achieved. Fabrication of modified 
hardware is in process. It is estimated that these "fixes" will all be 
incorporated into the development hardware by early next year. 

Assessment 

By way of summary and assessment, much progress has been achieved 
in the program. Identifying the fixes for the mechanical problems of 
the HP OTP and proving them out is the major immediate challenge. Once 
that is accomplished, accumulating engine running time over the power 
spectrum to demonstrate sufficient durability for commitment to MPT 
is a key requirement. 
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For the longer term, consistency in performance both run-to- 
run and engine-to-engine must be demonstrated to provide confidence 
in the design. Preferably such demonstrations should be accomp- 
lished if at all practicable with engines that incorporate all the 
performance fixes referred to earlier. Such demonstrations will, of 
course, be a part of the test program required to establish confi- 
dence in the durability of the engine for operational use. 

As noted earlier, the MPT schedule has been impacted. Without 
intending to be pessimistic, it must be noted that the possibility of 
an impact on the OFT schedule is present. The demonstrated ability to 
accumulate much running time in a short period offers the possibility 
that an impact can be avoided if the fixes are successful and no new 
problems surface. In any event, it would seem prudent to consider 
contingency plans for meeting the established testing goals for engine 
flight certification for OFT. It would also be appropriate to examine 
whether any alternate approaches to achieving flight certification 
might be advisable. Of course, any such changes in plans should be 
the subject of thorough management review. It is this aspect of the 
program and the testing itself that will be the focus of Panel atten- 
tion on the Main Engine for the coming year. 


AVIONICS 


It is difficult to make a specific critique of the Shuttle 
Avionics system because the problem really is the determination of 
the level of confidence in its proper operation as a result of 
testing of the complex system that has so far in the ALT program 
demonstrated its success. 

The system is divided into two parts and their testing; hard- 
ware, software, and the necessary integration or systems testing. 

Hardware has not been an undue problem, and the problems that 
have surfaced have been resolved in a timely manner v/ith very few 
"ghosts" left to plague our confidence. The Panel and the program 
both are concerned about the number of recant computer problems, but 
a new computer will be used for the orbital flight, and the redundant 
management of the present computers is satisfactory for the current 
operations. The Panel believes that the Management System can and will 
effectively cope with any unexpected "black box" problems. 

People tend to feel suspicious of software because, unlike hard- 
ware, you can't "kick the tires." Early on, the Shuttle software was 
plagued with escalating and changing requirements, but as that problem 
was controlled and laboratory system testing was emphasized, the soft- 
ware has straightened out and seems to be in good shape. Continued 
testing in the laboratories will enhance the degree of confidence that 
we now feel in the vital software area. We believe that successful 
ALT flights to date reflect a maturity of the Avionics system that is 
remarkable, considering the few times that the Orbiter has "played" 
together. 

The Panel's concern about the Avionics system for OPT centers 
around the new computer and the expanded mission as compared to ALT. 
Every effort must be made to structure and program it so that the 
test time and results already accumulated can be directly applied to 
the new computer. In the OFT configuration the enlarged memory and 
the new computer should in large part supply margins of safety, not 
open the door to unrestrained changes and additions to the computer's 
tasks. 


The Avionics system of the Orbiter is akin to the nervous 
system of a human being. Both are extremely complicated and have many 
of the same functions, sensory and physical inputs, signal condition- 
ing and transmission, prioritizing, computation, command, feedback, 
updating and monitoring of performance. In such a complicated system 
the number of permutations and combinations is so large that the major 
system problem is to be aware of the results of any possible combina- 
tion of inputs. Man formally spends about a quarter of his life try- 
ing to learn the limitations of his system in response to the 
environment and the characteristics of his personal components. In 
the Shuttle we do not have this long to learn our system, and thus 
this illustrates the major problem facing Orbiter Avionics. It is 
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ths understanding and correlation of the integrated elements in the 
time available so that we can predict the response of the system to 
any possible real set of inputs. 

For some parts of the system this can be done by analysis , 
for some by component test and, in the case of that indispensable 
component software, by running on the computers against all conceiv- 
able conditions. This assurance of component quality is very impor- 
tant and must be done, but just as a man must learn to use his own 
real set of components working together, so must tho Shuttle be run 
in final and real configurations sufficiently to demonstrate that its 
responses to real life are those designed for and expected of it. 

In the Panel's view, if there is an Avionics problem for OFT 
it is simply the time necessary for all-up configuration tests of 
sufficient depth to give management the confidence it needs for the 
first OFT. SAIL and ADL are needed for systems development tests, 
but to the extent that they are not physically identical to the 
Orbiter, time must be available for sufficient Orbiter 102 testing, 
either at Palmdale-DFRC or at Kennedy. 

The Panel's activities in Avionics for OFT will be centered 
around the new computer and the testing of the new software that must 
cope with an entire mission, including ascent and abort modes, not 
just the last subsonic portion as in the case of ALT. The perform- 
ances and successes of all the people involved in the Avionic,' 
system to date would lead us to believe that there are not insurmount- 
able obstacles for OFT, but that the degree of confidence in the 
system will be a function of discipline of requirements and the 
specification and performance of an adequate test program. 


20 


thermal protection system 


The Shuttle Thermal Protection System (TPS) remains a major 
concern in the preparations for Orbital Flight Tests (OFT) . One 
source of concern is the problem of obtaining adequate production 
rates for the RSI tiles. With this problem there is a potential 
desire to relax dimensional tolerances for the tiles. In addition, 
delays in obtaining certain specific sets of tiles are making it 
necessary to install the tiles out of sequence. Larger tolerances 
and out-of-sequence installation could both result in larger steps 
and gaps between tiles. At the same time, concern over temperatures 
in the Orbiter basic structure has led to a reshaping of the entry 
trajectory to reduce the total heat load experienced during entry. 

The changes in trajectory result in lower heat load being traded 
for higher heating rates. As a rule of thumb, a 25-degree reduction 
in structural temperatures results in a 100-degree increase in peak 
surface temperatures. Peak surface temperatures have thus increased 
from 2500 degrees to 2600 degrees Fahrenheit. A combination of 
higher peak heating rates and larger gaps and steps results in sig- 
nificantly Increased gap and step heating and raises the question of 
whether or not the current material can withstand this higher heating. 

There are several proble ms associated with obtaining the re- 
quired test data on the TPS. First, ground test conditions are not 
likely to result in the proper transition Reynolds number. It is 
probably true that the transition Reynolds number won't be known 
accurately until after the first entry flight. Knowledge of the 
transition Reynolds number is doubly important; not only are heating 
rates much higher for a turbulent boundary layer, but also steps 
between tiles will have a larger effect on heating in a turbulent 
boundary layer than a laminar one. Second, our arc jet facility 
capabilities are such that it is very difficult to provide the higher 
required test temperatures, especially with the proper boundary 
layers. Normally under ground test conditions boundary layers are, 
relatively speaking, thinner than they would be in flight and this 
tends to magnify the effects of gaps and steps. Finally, the overall 
capacity of arc jet facilities at Ames, Johnson and Langeiy is such 
that 100 percent success will be required to meet the present schedule 
of tests. There is little excess capacity for added tests in certain 
facilities if such would be required; and to make the situation even 
more difficult, arc jets are not the most reliable of ground test 
facilities, and facility failures are not uncommon. Any major failure 
could complicate scheduling problems. 

Future ASAP activities related to the TPS should include the 
careful tracking of any trajectory changes as they affect the trades 
between structure temperatures and surface temperatures. In addition, 
we should keep close watch on the TPS testing program because it is 
very critical to the qualification of materials. Consideration is 
being given to gap fillers in order to reduce the effects of the gaps 
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on both heating and boundary layer transition) but much remains to 
be done in the development of an acceptable gap filler pad. 

Finally , continued attention will be required in the RSI tile 
manufacture area because of the numerous difficulties that have 
been experienced in this area. 


* 
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HAZARD ASSESSMENT 


Foe the pest several months the Panel has been reviewing and 
participating in each step of the management of Safety, Reliability 
and Quality Assurance functions. Particular attention has been 
paid to the specific responsibility of the Johnson Space Center as 
the lead Center, and its role in risk assessments. 

The ALT successful flights to date verify the general ade- 
quacies of the Orhiter design in subsonic flight. 

During the past year improvements have been made in the manner 
safety consideration and evaluations were handled. There was a 
greater and highly visible interest by NASA Headquarters in suggest- 
ing improvements to the Safety, Reliability and Quality Assurance 
System, and in examining and questioning the findings. Efficient 
use of special task forces was made with good results. The Aerospace 
Safety Advisory Panel also concentrated on working much closer with 
Safety, Reliability and Quality Assurance organizations at the several 
centers involved. The increased attention resulted in a more aggres- 
sive approach to risk assessments. 

The imposition of several changes to the methods applied to the 
identification and evaluation of risks, particularly "single point" 
has strengthened the process. The four important changes ares 

1. adding an engineering representative to the 
Major Safety Concerns Screening Board, whose 
functions are: 

a. ensure periodic review of all identified 
safety concerns; 

b. review major candidate safety concerns 
in-depth; 

c. select major safety concerns for program 
management visibility; and 

d. document major safety concern status 
and closure rationale. 

2. adding representatives of program/project 
management as observers to the Major Safety 
Screening Board; 

3. the requirement placed on Johnson Space Center 
and already under implementation to conduct a 
critical functions assessment is being madu by 
the systems engineering group at the Johnson 
Space Center; 

4. develop a method to evaluate the aggregate risk 
involved. 
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Several additional and somewhat independent reviews are being 
proposed, i.e., an independent analysis of critical Shuttle Avionics 
systems and a Shuttle system Integrated functions assessment. 

Some of the questions the review of the Avionics system should 
answer aret 

1. What are the functions controlled by software 
which could cause loss of Orbiter and/or crew 
if a single command is, or is not, initiated 
because of a single software fault? 

2. What safety-critical commands, if inadvertently 
initiated in error, cannot be overriden by the 
crew? 

3. What safety^criticai commands inadvertently 
initiated by the crew do not have software 
controls to inhibit action? 

4. What is the plan for software prioritization of 
the safety-critical functions to assure that they 
are not buried in low priority functions? 

5. What are the safety-critical functions during 
planned single computer on-orbit operations? 

6. What is the complete software verification pro- 
gram in ADL, SDL and SAIL, and how does it verify 
the critical functions involving nomlnal/off-> 
nominal contingency events? What are the limita- 
tions of this program and resulting inadequacies? 

As NASA must use its resources judiciously, an in-depth review 
of the need for and the extent of these new approaches should be made. 
Perhaps the same end results can be obtained through other arrangements 
such as using existing personnel and organizations. 

The need for an aggregate risk assessment has generated several 
approaches to developing the needed information in the right format. 

The process of making a critical functions assessment by mission 
phase/events will provide much of the additional needed data. 

If implemented, the independent analysis of critical Shuttle 
Avionics systems will also provide useful data and increase the confi- 
dence in the aggregate risk assessment. The Panel will work with and 
monitor this effort at the Johnson Space Center. 

The Panel believes that the present Safety, Reliability and 
Quality Assurance System strengthened as indicated can perform a credit- 
able function in OFT 1 risk assessment. 
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HUMAN ERROR 


The Panel has studied in some depth and over a long period of 
time the various management paperwork systems used to control design 
and execution of design. These systems appear to assure that design 
features and design changes will be well thought out, and to assure 
the closing of the loop in the case of required changes. However, 
these paperwork systems are all dependent on the accuracy of perform- 
ance of work or of observation on inspection so that the input informa- 
tion to the paperwork or computer systems corresponds to the real world 
of the hardware. This has been referred to as the man-material inter- 
face as opposed to the various interfaces of paperwork systems, The 
Panel is now in the process of investigating the basis of confidence in 
this aspect of control. Visits to Downey and Palmdale have been made 
to determine how this is handled by RX and its subcontractors, Also a 
preliminary visit has been made to KSC. 

The control system starts with documents which establish inspec- 
tion points and procedures for major subcontractors as well as for RI. 
These are so selected as to assure that the quality and conformance of 
the work to this point can be verified. 

The Manufacturing Verification system (MV) permits manufacturing 
personnel to inspect work in process. These inspection points are 
spelled out in the manufacturing operations record. MV stamps are 
issued only to qualified manufacturing personnel and will be withdrawn 
if the individual is careless in certifying to work which is not in con- 
formance, The right to have an MV stamp is being developed to be a 
matter of pride to the individual so as to reduce the likelihood of 
work so stamped to fail in subsequent QA inspection. A similar process 
being established at KSC is called Designated Verification (DV) . 

The contractor quality assurance personnel are responsible for 
final in-process verification. Xn general, this QA signoff will include 
a determination that the previous MV stamped steps are correct, Only 
items which are previously determined to be non-critical are permitted 
to be passed by the MV procedure if they cannot be later picked up by 
the QA inspection. 

Suitable Government agencies are used for final acceptance of 
the work. These are the Defense Contract Administration Services for 
RI and the majority of subcontractors, and Navy, Air Force or FAA in 
specific instances. From manufacturing flow plans and problem reports 
mandatory inspection points are set. NASA establishes controls, tests, 
and inspection, metrology and reporting systems. 

The system is highly dependent oft the use of personnel with a 
previous track record of experience and/or detailed extensive training. 
Common inspection requirements for manufacture, assembly, and pre- and 
post-flight aid in the human factor. Use of streamers (red flags) on 
non-flight hardware with numbered records of their addition and removal 
decreases the likelihood of leaving such articles on during flight. 
Detailed test and checkout procedures are used to assure correct posi- 
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tioning of valve*, switches and to forth. 

The ba*i* of confidence in the system may bo summarised as 
follows t 


1. audits show no significant deficiency in the 
system; 

2. surveillance inspections correct any physical 
discrepancies on the spot; 

3. systems are progressively improved; 

4. fewer problems are found on each flight; and 

5. statistics show that most discrepancies are 
found before final inspection, a better average 
than industry in general. 

Thera remain concerns which must be continuously watched, 

People will fail to follow instructions, especially if not clearly 
written, or written without concern for the human element, Changes 
can confuse people. Over-familiarity with the system may cause some 
people to bypass procedures, 

The need for continual updating of inspection checklists, 
modification®, and temporary installations give particular trouble 
because of lack of experience with these. Procedures for handling 
unexpected conditions, such as spills, must be reviewed and continu- 
ally updated. 

Implementation of the system defined herein has reduced human 
errors. Continued monitorinq is required to assure that all disciplines 
and controls are maintained. Corrective action must consider the con- 
tribution of human errors to all discrepant situations, 
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NEW PROJECTS 


Tnus far today the speakers have concerned themselves with the 
Panel's traditional role in the Space Shuttle program where we have 
bean concerned with the safety of man in space— our Number One 
Priority. It now seems appropriate to extend a portion of the inter- 
est and activities of the Panel to NASA's aeronautic and non-manned 
space activities. In order to introduce the Panel to this area we 
have met earlier today with Dr, James J. Kramer, NASA's Associate 
Administrator for Aeronautics and Space Technology, for a briefing on 
the general activities, and we intend to follow up with in-depth 
discussions with the appropriate programmatic people. In this en- 
deavor we ate fortunate to have on the Panel Drs. Himmel and Syvertson 
who are both involved in these NASA activities. 

It is the Panel's intent to develop a schedule of its activities 
in NASA's areas other than manned space flight and to submit such a 
schedule for Headquarters' concurrence before we proceed. Suffice it 
to say that the Pa..5l is very interested in these, new to it, activities, 
and will expect to make an effective contribution to these programs. 
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RETROSPECT 


I joined the NASA Aerospace Safety Advisory Panel four years 
ago. During most of the time 1 have served with the Panel 1 was also 
on active duty as an Air Force Lieutenant General, serving as the 
Director of the Defense Nuclear Agency here in Washington. I have 
submitted my resignation from the Panel because of the demands of 
the position X accepted in industry when I retired from the military. 

X wa3 most reluctant to leave the Aerospace Safety Advisory Panel, 
having found a great amount of satisfaction in the close association 
with the NASA staff, the industries which work with N*SA, and with 
the very dedicated members of the Panel. 

It also has been very exciting and rewarding dealing with some 
of the problems which have come to the attention of the Panel during 
this period. I believe the Panel has contributed valuably and hope 
that X had some small part in that contribution. 

I must admit that initially X was somewhat reluctant to chall- 
enge or criticize anything NASA was doing. Frankly, NASA's successes 
had been so stupendous that I was almost overawed. I found, however, 
that even NASA was occasionally guilty of complacency, possibly be- 
cause of those past successes. Occasionally I noted someone who was 
afflicted by the old syndrome of: "But we've always done it that way." 

So, soon I fov-d myself playing the role of a hero worshiper who has 
realized that even his hero can occasionally be human. Perhaps even 
more important I found that the hero (NASA) was receptive to challenges. 
I found that NASA management at every level was highly aware of the 
need for criticism, I also found they were patient when we asked 
what often appeared to be silly questions. If indeed NASA was human, 
NASA was also eager to listen and quick to react. It certainly seems 
to me that NASA has responded promptly and thoroughly to the some- 
times cynical input from the Aerospace Safety Advisory Panel. 

I mentioned and must re-emphasize my reluctance to relinquish 
my association with the Panel. I really hate to give it up. It gets 
me right under this NASA badgj. However, I must admit that my leav- 
ing is probably healthy for tae Panel. I believe it is good to have 
some turnover in the membership of the Panel. A new critic is better 
than an old critic. Some new thoughts are good for the Panel, just as 
they are for NASA. Thus, I am sure that whoever replaces me on the 
Panel will enhance its value to NASA and to the Congress. 

Perhaps I may offer a few suggestions. First, I believe that 
it may have been valuable to have had on the Panel an individual who 
had an active role with the Department of Defense. It seems to me 
that the close interface between NASA and DOD is most important in 
the development and deployment of the National Space Transportation 
System. I realize that both NASA and the DOD have exerted major 
efforts to assure such an interface. Yet I believe that effort can 


28 


bear even further emphasis because of the fact that this system 
literally represents the total commitment of the United States 
for manned space activity and indeed for most of its space 
activity for the foreseeable future. 

I believe it is essential that there be separate roles for 
NASA and DOD, However, 1 have seen some evidence of the jealous 
guarding of traditional roles and prerogatives. Because of the 
tremendous scope of the Space Shuttle program, because it is so 
important to the United States and indeed to the world, because it 
is unique and cannot be bound by tradition, I believe it is essen- 
tial that both DOD and NASA challenge those roles. They should 
deliberately examine whether some traditional roles should be 
changed. 

For example, I am aware that they have examined the command 
and control aspects of the Space Transportation System and that 
there is a consciousness of the need to avoid costly duplication. 

X am convinced NASA can perform this role for the DOD without any 
sacrifice of effectiveness and with due regard to the need for 
careful adherence to international treaties. I am aware that some 
of my DOD contemporaries may feel such remarks are heretical, but 
X believe most would agree. As I indicated, X am aware that this 
specific role has been discussed, but I urge continued attention. 

As noted by Willis Hawkins, the operational mission of the 
Space Shuttle is really a new role for NASA, since all previous 
space ventures have been one-time flights. I would hope that NASA 
will draw heavily upon DOD operational safety, and maintenance ex- 
perience, since the Space Shuttle clearly must serve as an opera- 
tional aircraft as it returns to its soft landing and its turn- 
around operation. Going back to the remarks by Willis Hawkins, 
perhaps also is, ore emphasis should be placed on the experience of 
the transport industry. Again, I know NASA and the Air Force are 
working closely together, probably even more closely since one of 
NASA's Center Directors is now the Under Secretary of the Air Force 
and an ex-Air Force Director of Laboratories is the Deputy Adminis- 
trator of NASA. However, I wonder whether anyone has really set out 
to challenge those traditional roles. I suggest that the Aerospace 
Safety Advisory Panel might help to do so. In fact, I'll go even 
a bit further to recommend that the Panel's charter might be expanded 
to require it to look over DOD's shoulder as well as NASA's. 

Finally, I would like to comment briefly about a role I be- 
lieve the Panel has fulfilled. Often during the past four years I 
have noted that the Panel, working quietly with the NASA and 
industry management teams, has brought about change without fanfare 
and often without really surfacing the issue. In many cases the 
detailed conversations and working sessions in which the Panel par- 
ticipated have resulted in decisions which might otherwise have 
been missed, or at least delayed. In many cases there was no written 
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report, no seeking of credit by either the Panel or the others in- 
volved. It has simply been good teamwork, and the personal satis- 
faction from such actions has been rewarding indeed. I realize 
that some of the Panel's activities require documentation and I 
believe the record shows abundant accomplishment. I suspect that 
those quiet accomplishments that were never written down are at 
least equally abundant. 

Lest X appear bragadoccio, let me hasten to add that my 
personal contribution has been very small indeed. The Aerospace 
Safety Advisory Panel as a whole, and very ably led by its Chairman, 
Howard Nason, has provided some very dedicated and sustained efforts. 
X believe its individual members have served its charter extremely 
well and I appreciate having had the opportunity to serve with these 
fine people and this great organization. 
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STATEMENT TO SENATE SUBCOMMITTEE 


on 

SCIENCE, TECHNOLOGY AND SPACE 
by the 

AEROSPACE SAFETY ADVISORY PANEL 
February 22, 1978 


I am Herbert E. Grier, Chairman of the congressionally estab- 
lished Aerospace Safety Advisory Panel of the National Aeronautics 
and Space Administration. At your request I should like to acquaint 
you with our Panel, its method of operation, and our assessment of 
NASA's Shuttle program. 

The "housekeeping" for the Panel and its staff of three people 
is done by NASA Headquarters, but the Panel itself is an independent 
body that schedules its own investigations and submits its annual 
reports to Congress and the NASA Administrator. The Panel feels an 
obligation to be a timely force in the management system, and reviews 
its findings with the appropriate people in NASA as the investigations 
are completed. Our relations with the programmatic groups are excel- 
lent and their responses to our comments are full and sincere, In 
fact, we find that we must be careful not to unwittingly trigger an 
undue response to a minor point. 

The majority of the Panel members are from outside NASA and 
al| i<-(? experienced in the management of technical expertise. The 
deiitsrations are such that each and every member is heard and inde- 
pendently contributes to our reports, which are a consensus, not a 
compromise. 

The members of the Panel are listed below, and I have just 
recently been chosen to be Chairman. Mr. Howard K. Nason has been 
our most recent past Chairman, and Dr. Charles D. Harrington was the 
first Chairman when the Panel was established in 1968. 

Members, Aerospace Safety Advisory Panel 

Lt. Gen. Leighton I. Davis (USAF, Ret.) 

Mr. Frank C. Di Luzio 
Mr. Herbert E. Grier 
Dr. Charles D. Harrington 
Mr. Willis M. Hawkins 
Dr. Seymour C. Himme’ 

Mr. John L. Kuranz 

Mr. Howard K. Nason 

Mr. Clarence A. Syvertson 
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Each of the members spend two to four days per month on Panel acti- 
vities and, as Chairman, I spend from one to two weeks per month 
on behalf of the Panel. 

The Panel's objective, and the limitation on the members' 
time, indicate that we can be expected to review NASA operations 
only to the extent necessary to judge the adequacy of the NASA 
management system to Identify risks and to cope with them in a safe, 
efficient manner. 

Before talking about the Shuttle specifically, X should like to 
make a few observations on the philosophy of management and the changes 
in that philosophy that we have perceived in NASA over the years. 

NASA's early task was to implement a national commitment to 
space exploration in a specified time frame. In order to do this 
NASA had to develop not only the technology, but also the capability 
to solve unknown problems in a timely manner. The results were spec- 
tacular and the capability and expenditures massive. With changing 
priorities, a greater knowledge of space, and the shifting of emphasis 
from exploration to utilization, NASA experienced pressure to move 
into a success-oriented program plan for the development of the Shuttle. 
In such a program one assumes that the basics are known, accepts only 
the identified contingencies, and plans staff, hardware and facilities 
on this basis. If all works as planned this is by far the most economi- 
cal way to accomplish a program. However, when unforeseen events do 
occur, the schedule must be relaxed and/or more funds made available 
to solve the unforeseen problems. Phrased another way, planned maxi- 
mum economy must have some flexibility in budget and schedule. The 
Panel believes that this is an appropriate mode for Congress to ask 
NASA to operate in. If all involved understand the process, no undue 
or increased risks need to be incurred. The principal difficulty with 
success-oriented planning is the controversy that arises as to whether 
a contingency should have been or was planned for, and this causes a 
tendency to overlook the fact that success-oriented planning in a 
patient and understanding system will be the most economical. 

The Panel's observations of the NASA management system have led 
it to the conclusion that the system is objective and competent, and 
while there were some initial learning problems in establishing success- 
oriented programming for a project as large and complex as Shuttle, 
safety does not seem to have been sacrificed as a result. We have, 
however, arrived at the conclusion that any restrictions of the test 
programs directly supporting the upcoming orbital flight tests must be 
carefully examined and weighed. 

In its investigations and deliberations the Panel has obviously 
formed opinions on the state of the various parts of the projects. These 
opinions follow, grouped by the Panel's specific categories of fact- 
finding. 
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1, Mission Operations 


The Panel has been preoccupied with the mission planning 
for the approach and landing test series. The ALT was pursued 
in an orderly manner and efficiently executed. This bodes 
well for the mission planning for the orbital flight tests, 
although it is completely different in scope and magnitude. 

The Panel is now reviewing the OPT planning and particularly 
the provision for the various abort contingencies. It is too 
early to evaluate this subject completely, but it seems to be 
off on the right foot with a team that has demonstrated compe- 
tence in the ALT program. 

2. Thermal Protection System 

The Thermal Protection System is a problem of a different 
character. It is a new technology and must be evaluated by 
plasma arc testing of small samples. The desired thermal 
characteristics are so difficult to achieve that questions of 
bonding, fragility and reusability must of necessity take second- 
ary roles during the development. Methods of inspection, refur- 
bishment, replacement of bad tiles and perhaps even continued 
exposure to humid air at the launch sites must be determined 
from experience. We are continuing to monitor this program, but 
at present do not believe that the safety of the crew on the 
initial flight is at stake and feel that some of the other con- 
cerns must simply await full-scale testing. At this moment we 
feel that the economics of a conventional aluminum air frame are 
somewhat offset, but not overbalanced by what might be problems 
of reusability of the TPS tile. 

3 . Orbiter 


We have deliberatley assigned the consideration of the 
Orbiter as a vehicle to our Panel member with the most experi- 
ence in transport aircraft. The Orbiter in its intended use is 
a transport and should take advantage of the lessons learned in 
that industry. There are differences between the Shuttle and a 
transport, for instance, in the matter of certain mechanical 
system redundancies. We have brought this matter tc the atten- 
tion of the program and it has been thoroughly considered. We 
acknowledge the difficulty of making the Shuttle adhere to all 
the constraints of design of transport aircraft, particularly 
since it is now an experimental vehicle. However, the Panel 
feels that the routinely operated and maintained operational 
Shuttle would benefit from all critical subsystems being redun- 
dant. 


One of the Orbiter subsystems that has been troublesome in 
the past is the Auxiliary Power Unit (APU) . Initial runs were 
with less than optimum machines, and current progress seems to 
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be resolving the difficulties. There is one problem, however, 
that is not yet resolved and that is the problem of hot restart. 
The catalyst bed is so hot when the machine is stopped that it 
will not restart properly unless the bed is cooled by being 
purged with a gas such as nitrogen or helium. The purge system 
was not considered vital in the early stages of design and was 
a weight tradeoff. The current mission profiles, particularly 
abort situations, make hot restart desirable and methods of ac- 
complishing this are being considered. A purge or other cooling 
system may be necessary. 

4. Propulsion 

The Shuttle propulsion system consists of the three main 
engines, the propellant tank, and the two solid rocket boosters 
and interconnecting plumbing and wiring. Each of these com- 
ponents has its own set of problems and will be discussed in 
turn. 


The Space Shuttle Main Engine (SSME) is perhaps the most 
obvious place where success-oriented planning may now be a prob- 
lem. The time necessary to procure and/or modify turbopump 
hardware is so long that should current problems persist, 
schedules may have to slip. It is also apparent now that more 
basic development work at the component level should have been 
done. The original decisions were made by a number of people, 
and the fact that in this case the troubles have exceeded the 
norm should not be viewed as a breakdown of the system. In 
fact, there are some bright sides to the SSME situation. A 
high thrust, reusable throttleable engine has been built and 
has accumulated a significant operating time. The control of 
this engine by a computer operating in the engine environment 
has been eminently successful and represents a major breakthrough 
in engine control technology. The loads and speeds involved in 
the turbomachinery may, now that we are having difficulty, re- 
quire some basic support work to the empirical machine design. 

It is the Panel's understanding that such activity, for instance, 
in turbine blade structural design, is now being used. The Panel 
is not comfortable with the current status of the SSME, but this 
is a matter of caution. We see evidence to indicate that a safe, 
serviceable engine can be made; however, current problems may 
impact schedules. 

The propellant tank does not seem to have any major technical 
problems. Fluid flow and POGO phenomena seem to be under control 
and we feel that the matter of the tank's protuberances shedding 
ice can be solved. The plumbing, while massive in size, does not 
involve new technology and should present no critical problems. 



The solid rocket boosters represent an increase in size 
of an established technology that seems to be behaving as 
predicted. He are monitoring this program, but feel that the 
issues, if any, are matters of quality control and tailoring 
rather than any significant new technical problems. 

The recent investigation of a failure of a Delta vehicle 
caused by a strap-on solid booster is being carefully monitored 
by the Panel to make certain that any lesson learned there is 
fed into the Shuttle SRB program. 

A fourth element of the propulsion system is the orbital 
maneuvering engine and small reaction control rockets. In the 
Shuttle picture these components have a lower priority than, 
for Instance, the main engine. The Panel has just begun to 
look at these areas and has not formed conclusive opinions or 
judgments at this time. 

5. Avionics 

The Avionics for the approach and landing test series un- 
covered a few problem areas in computer management, but did not 
prevent a successful series of tests. The performance was in 
fact good. The Avionics task for the orbital flight tests, 
however, is much more complicated and extensive in that ascent, 
orbit and descent all have to be accomplished. The new com- 
puters with the double-density memories are a help, but current 
demands are crowding this new capability. This software load 
must be closely monitored. The Panel feels that the Avionics 
system will present no unmanageable problems, although the re- 
dundancy management of the computers themselves must be thorough- 
ly explored for failure modes that might shut down all computers. 

6. Hazard Assessment 


The subject of hazard assessment is not one of the Shuttle 
subsystems, but is vital to the understanding of the risks associ- 
ated with the Shuttle operations. The Panel has been interested 
in this area for some time and has played a role in getting a more 
complete involvement of the various program groups in the evalua- 
tion of hazards, both individually and cumulatively. The Panel 
has been investigating the need for an independent audit or review 
of the Avionics system. We are concerned with the rapidity with 
which the double-density memory capability was used up, and feel 
that rigorous controls must be established. 

7. Control of Human Error 

The Panel has been concerned that the massive effort wn the 
Shuttle program could be compromised by a relatively insignificant 
failure on the part of a person who had either not been properly 
trained or who had not been given due consideration in the man- 
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machine interface. The solution to this problem takes the 
form of training, checklists, and people-oriented design. 

The Panel is concerned that this problem may be overlooked 
in the press of the severe technical challenges that exist 
in many parts of the program. When the * chips are down" 
these pedestrian problems can be crucial and frustrating. 

Another aspect of human error is the control of processes 
where specifications are incomplete or, of necessity, impre- 
cise. The resulting personal interpretation or inadvertent 
deviation can be of major importance. The Panel is investigat- 
ing the control of this factor to evaluate its importance. 

8, Payload Hazard Asses sment 

An area of concern to the Panel and one it is now pursuing 
is that of the compatabilty from a risk point of view of the 
Shuttle with its intended payloads. In any payload/Shuttle 
interface the same rigorous design, test, and inspection pro- 
cedures must be observed, and crew training, including simula- 
tion, must be accomplished. It is important that the combina- 
tion of Shuttle and payload be safe, but in addition, effective. 

9. Launch Preparation 

A review of the orbital tests is incomplete without mention 
of launch preparation and logistics. However, the Panel's at- 
tention has to date been on the Shuttle itself rather than on 
the launch operations. This has been an appropriate emphasis, 
and the Panel is beginning to study the launch operation. 

In summary, the Panel views the Shuttle program more philosophi- 
cally than the program personnel; hence, when asked "What are the major 
safety problems in the Shuttle?" we tend to answer in a framework that 
is different than that of a person or group involved in specific techni- 
cal problems and their solutions. At the present time we feel that one 
of the important safety considerations is the effect of the schedule 
driving technical people to make "fixes" rather than to engineer the 
solution to a problem. 

Secondly, we are concerned that further cutbacks in testing may 
jeopardize the verification of the capability of subsystems to meet the 
demands placed upon them. This is particularly true of non-redundant 
systems and software where extensive testing is the only way to explore 
all the variations of input that might produce an improper output. 

Allied to this is the concern that the computer and its new memory do 
not have the capacity margin that was envisioned when the double-density 
memory was designed. 
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Wo also are concerned with tho criteria for development of new 
technology which requires both performance and long life in the initial 
product* Hie normal stages of a development are to attain the perform- 
ance and then, from experience# make the modifications to attain the 
required life. In areas of new technology such as the main engine it 
in difficult to achieve both final life and initial performance in one 
step. 


The Panel views its role as bringing these questions to manage- 
ment's attention rather than submitting specific solutions to a current 
technical problem. We monitor these problems as indicators of the 
state of the development, and we feel that the program has responded 
appropriately. This procedure will produce a safe and effective Shuttle 
whose life will be verified by the flight test program, but whose 
schedule may be impacted if current problems do not respond in a timely 
manner. 


We should emphasise that in the presentation to NASA of our com- 
ments and independent poi it of view we are more than satisfiod with the 
programmatic response and attention that senior NASA management gives 
our opinions. The Panel's audit does contribute to a safe and effective 
NASA program. 
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1977 PANEL MEETINGS 


January 14 


April 13 


Status of Preparation for ALT Program - JSC 
Miaglon Operations 

Mission rules and contingency plans, including 
provisions for emergency separation and jettison, 
Handling of anomalies in terms of their proper 
resolution and assessment of impact on subsequent 
flights. 

Shuttle Carrier Aircraft 


Remaining open items which when closed complete 
certification of the aircraft for the ALT program. 

Mated aerodynamics, performance and flight controls 
as to their effect on structure and pilot control, 

Orblter 

Potential impact of modifications deferred from 
Palmdale to DPRC on the flight schedule for inert 
Orbiter flights. 

Results of CARR and remaining certification work for 
the first all-up systems manned Orbiter flight. Diff- 
erences between doing integrated tests at DPRC and 
Palmdale . 

Status of Preparations fer Manned Active Flights 

in ALT - DFRC 

Overview of inert captive flight test results, 

This covered dynamics, performance, loads, sta- 
bility and control and separation. The purpose 
was to assess whether results were as predicted 
and to evaluate any anomalies. 

Manufacturing and test status of the Orbiter. 

This covered the remaining manufacturing and re- 
test activities and the scope of the Delta inte- 
grated checkout to assure the vehicle would be 
ready for flight. Particular attention was given 
to the APU. 

Review of the flight test program with the active 
Orbiter to review the current objectives and the 
associated mission and contingency planning. 
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April 14 


Review of Detailed Inspection of Following 

Areas Rockwell/Downey 

The method by which systems certification for 
the entire Orbiter is accomplished prior to 
flight. This included APUs, hydraulic systems, 
control system, main computers, backup computer 
and control system, cockpit equipment, etc. 

Exceptions to spec performance. This focused on 
the significance of these exceptions as con- 
straints on a safe mission. 

Changes made to the Orbiter since it left Palm- 
dale and the contractor's visibility and 
control over the checkout process by which the 
newly installed equipment had been certified before 
it was assembled. 

July 18, 19 Review of Results of Captive/Active Flights and - JSC 
Work Remaining before FAL 

The objective as in the other inspections was 
to assess the developing basis of confidence 
for proceeding with the next series of flights, 
the major risk involved and problems remaining to 
be resolved. The agenda included the following. 

Certification of the Orbiter for the aero- 
dynamic load envelope based on captive/ 
active flights and analyses. 

Orbiter subsystems , covering the performance 
and anomalies of the APU and hydraulic system, 

Avionics hardware and software and flight 
control system during captive/active flights. 

In addition, a review of the anomalies on the 
remaining systems was conducted. 

Remaining work on Orbiter subsystems, covering 
modifications to bring the vehicle into config- 
uration for the first free approach and landing 
test, and a summary of certification status. 

Major risks accepted for this series of flights, 
including control of such hazards as the APU 
hydrazine leak into the Orbiter as on the first 
captive/active flight 1*>&. 
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October 11 


October 12 


December 14- 
15 


Review of program Director's Policy and - Washington# D.C. 
Plans for Orbital Flight Test Program 

Given the Panel's preoccupation with ALT 
the review of the Program Director's policy 
and plans for the orbital flight test pro- 
gram provided the Panel a status report on 
changes since their last review. In addition# 
the Panel received an assessment of aeronautics 
planning from the Associate Administrator for 
Aeronautics and Space Technology. 

Annual Meeting - Washington, D. C. 


This is described in the body of the annual 
report and consisted of a presentation by 
each Panel member on his assessment of his 
area of responsibility. 

Assessment of the Adequacy of the Overall - Rockwell/Powney 
Test Program for OV 102 for Orbital 
Flight Test Program 

This review was also to assess the accept- 
ability of the plans to use the Structural 
Test Article as the orbital vehicle. Par- 
ticular attention was given to the program 
changes since 1974 and the rationale for 
their acceptability. The review, therefore, 
covered the followings 

Overview of certification-verification 
plan for the Orbiter. 

Combined element verification plan. 

Structures development and qualification 
testing. 

Major ground test program covering the 
description, objectives and rationale for 
any changes in the main propulsion test 
program, the mated vehicle ground vibra- 
tion test and one-quarter scale tests, 
flight control hydraulics, laboratory 
tests and the Avionics tests in the ADL 
and SAIL laboratories. Attention also 
was given to the OMS and RCS tests at 
White Sands as well as the vibro-scoustics 
tests . 



Rationale for the use of the Structural Test 
Article as OV-99 orbital flight vehicle. 

Simulated flight test plan on the integrated 
flight vehicle and software. 


1977 FACT-FINDING MEETINGS 
by 

Individual Panel Members 


January 21 
February 2 

February 3 
February 22 

February 23- 
25 

March 2 
March 25 

May 2-4 

May 18 
June 1 

June 14 
June 21 

June 28 
July 7 


Held meeting concerning flight control 
systems and APU. 

Held meeting with Mr. John F. Yardley, 
Associate Administrator for Office of 
Space Flight regarding Shuttle program. 

Attended Flight Readiness Review of 
ALT flight. 

Conducted review of Space Shuttle Main 
Engine "Review Item Discrepancy " (RID) 
status resulting from SSME Critical 
Design Review conducted in October 1976. 

Participated in Space Shuttle Level II 
Hazards Screening Board as contributing 
member. 


Rockwell/Do wney 


Washington, D.C. 


DFRC 


MSFC 


JSC 


Witnessed captive ALT flight. DFRC 

Participated in Center Management SSME MSFC 

Quarterly Review, obtaining updated 
engine status and NASA/Contractor 
activities . 


Participated in Hazards Screening Board JSC 

to examine Orbiter 101 regarding up- 
coming ALT program. Reviewed subsystems 
and particularly single point failure 
concerns. 

Attended ALT Flight Readiness Review. DFRC 

Attended meeting with Rockwell personnel Rockwell/Downey 
concerning the APU, the hydraulic system 
and status of Avionics. 


Attended Mission Readiness Review. DFRC 


Attended meeting with NASA administra- Washington, D.C. 

tion personnel. 

Witnessed ALT flight. DFRC 

Attended meeting with NASA Administrator Washington, D. C. 
and Deputy Administrator, Drs. Frosch 
and love lace . 


44 



I 


July 14 
July 17-18 
July 18 

July 27 
July 29 

August 2 
August 2 

August 8 

August 24 

August 26 

August 30 
August 31 

September 9 
September 13 


Attended administrative meeting at NASA 
Headquarters . 

Attended meeting for fact-finding on 
Thermal Protection System. 

Held review of specific concerns associ- 
ated with SSME turbomachinery and the 
engine test program. 

Attended Mission Control conduct of an 
ALT flight. 

Held administrative meeting with NASA 
Administrator and Deputy Administrator, 

Drs. Frosch and Lovelace. 

Attended meeting investigating hydrazine 
leak during captive flight. 

Participated in Center Management Quarter- 
ly Review, obtaining updated engine status 
and NASA/Contractor activities. 

Attended Flight Readiness and Technical 
Readiness Reviews for active Space Shuttle 
Orbiter. 

Held discussions concerning methods used 
to control and check upon human error. 
Modified inspection systems were described, 
including Designated Verification. 

Held meeting with General Accounting Office 
personnel concerning Shuttle's critical 
elements. 

Witnessed conduct of ALT flight. 

Held administrative meeting with Assistant 
Administrator for DOD and Interagency 
Affairs and Panel staff. 

Attended Entry Working Group meeting to 
review status of Shuttle aerodynamics 
characteristics with emphasis on flight 
test results versus wind tunnel tests and 
analysis based on ALT data. 

Attended Mission Readiness Review and 
observed second manned free flight. 


Washington, D. C. 
ARC 

Rocketdyne 

JSC 

Lockheed 

Rockwell/Downey 

MSFC 

DFRC 

KSC 

Lockheed 

DFRC 

Washington, D. C. 
JSC 


DFRC 
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September 13 
September 26 

October 4-6 

October 5 
October 5-7 

October 25 
November 14 

November 29- 
30 

November 30 
December 2 
December 8-9 

December 16 
December 20 


Held meeting concerning APU. S unstrand 

Held discussions regarding Shuttle Rockwell 

problems. 

Examined the approach and methodology JSC 

used by NASA and its Contractors in 
their risk assessment activities and 
definition of aggregate risk for a 
Shuttle mission. 


Held administrative meeting with Washington , D.C. 

NASA Headquarters personnel. 

Held discussions concerning Manufactur- Palmdale , Rockwell 

ing Verification as applied by Rockwell 

International and direct subcontractors 

to control of human error. Application 

to sub- tier contractors is dependent 

upon paperwork control at this time. 


Attended review of results of ALT flights. Rockwe 1 1/Downey 

Attended review of ALT ferry considers- DFRC 

tions. 


Participated in SSME Quarterly Review MSFC 

and conducted status review of Shuttle 
External Tank and Solid Rocket Booster 
programs. 

Attended meeting of investigative board General Dynamics 

concerning Atlas Centaur failure. Convair 


Attended investigative meeting concerning ARC 
payloads. 


Attended administrative meetings; fact- Washington, D.C. 

finding on payloads, Spacelab, aircraft 
programs and Shuttle. 

Attended meeting concerning payloads. ARC 


Held administrative meetings with NASA Washington, D.C. 

Admini s t r at or . 
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